BUG/MINOR: http: fix several off-by-one errors in the url_param parser

BUG/MINOR: http: fix several off-by-one errors in the url_param parser

Several cases of "<=" instead of "<" were found in the url_param parser,
mostly affecting the case where the parameter is wrapping. They shouldn't
affect header operations, just body parsing in a wrapped pipelined request.

The code is a bit complicated with certain operations done multiple times
in multiple functions, so it's not sure others are not left. This code
must be re-audited.

It should only be backported to 1.6 once carefully tested, because it is
possible that other bugs relied on these ones.